analysis() and inventory-dependencies.json¶

Section 13 · From docs/INVENTORY_REFERENCE.md on GitHub

InventoryResult.analysis(top=25) returns the dictionary that export() writes to inventory-dependencies.json. It uses a dependency graph built with include_hierarchy=False.

Key	Type	Content
`shared_dependencies`	`list[dict]`	`graph.shared_dependencies(top)`, 12.3.
`largest_blast_radius`	`list[dict]`	`graph.blast_radius(top=top)`, 12.4.
`cross_account_edges`	`list[dict]`	Every cross-account edge, 13.1.
`security_coverage`	`dict`	13.2.
`unresolved_references`	`list[dict]`	Same list as the map, section 11.

13.1 cross_account_edges¶

cloudg.inventory.dependencies.cross_account_edges(assets, edges). Edges between two assets with different, non-empty account_id, except CONTAINS edges between two hierarchy assets (OU → account). Unlike summary.cross_account_edges, hierarchy-flagged edges are not filtered here, but they never cross accounts.

Key	Type	Meaning
`source`	`str`	Source `arn` (or `id`).
`source_account`	`str`	Source account.
`target`	`str`	Target `arn` (or `id`).
`target_account`	`str`	Target account.
`edge_type`	`str`	Edge type.
`relationship`	`str \\| None`	Relationship.
`external`	`bool`	Either endpoint is an external (unmapped) account placeholder.

[
  {
    "source": "arn:aws:organizations::123456789012:policy/o-1wietecbs4/service_control_policy/p-FullAWSAccess",
    "source_account": "123456789012",
    "target": "arn:aws:iam::552289857375:root",
    "target_account": "552289857375",
    "edge_type": "GOVERNS",
    "relationship": "SCP_RESTRICTS",
    "external": false
  },
  {
    "source": "arn:aws:iam::999999999999:root",
    "source_account": "999999999999",
    "target": "arn:aws:iam::123456789012:role/orders-worker",
    "target_account": "123456789012",
    "edge_type": "IAM_TRUST",
    "relationship": "CROSS_ACCOUNT_TRUST",
    "external": true
  }
]

13.2 security_coverage¶

cloudg.inventory.dependencies.security_coverage(assets, edges).

Key	Type	Meaning
`services_by_account_region`	`dict[account, dict[region, dict[service, bool]]]`	For every asset with `metadata.security_service`: whether that service is enabled in that account and region. A service is `true` when any of its assets there is enabled. Account-wide services appear under `global`.
`gaps`	`list[str]`	Every `false` cell as `"<account>/<region>: <service>"`, sorted.
`workloads_without_vulnerability_scanning`	`list[dict]`	`EC2`, `CONTAINER_REGISTRY` and `LAMBDA_FUNCTION` assets (any provider) that are not the target of a `MONITORS` edge from an enabled `VULNERABILITY_SCANNER`. Items: `{"name", "arn", "type", "account_id", "region"}`.
`internet_facing_without_waf`	`list[dict]`	Internet-exposed `LOAD_BALANCER`, `API_GATEWAY` and `CLOUDFRONT` assets that are not the target of any `PROTECTS` edge. Items: `{"name", "arn", "type", "account_id"}`.

{
  "services_by_account_region": {
    "123456789012": {
      "us-east-1": {"guardduty": true, "securityhub": false, "inspector2": false,
                    "macie": true, "config": false, "cloudtrail": false},
      "global": {"shield": true}
    },
    "552289857375": {
      "us-east-1": {"guardduty": false, "securityhub": false, "inspector2": false,
                    "macie": true, "config": false, "cloudtrail": false}
    }
  },
  "gaps": [
    "123456789012/us-east-1: cloudtrail",
    "123456789012/us-east-1: config",
    "123456789012/us-east-1: inspector2",
    "123456789012/us-east-1: securityhub",
    "552289857375/us-east-1: cloudtrail"
  ],
  "workloads_without_vulnerability_scanning": [
    {"name": "web-1", "arn": "arn:aws:ec2:us-east-1:123456789012:instance/i-2b95636493d3a307e",
     "type": "EC2", "account_id": "123456789012", "region": "us-east-1"}
  ],
  "internet_facing_without_waf": [
    {"name": "web-alb",
     "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/2466d6929fc1473a",
     "type": "LOAD_BALANCER", "account_id": "123456789012"}
  ]
}